io. github. pscale-commons/ bsp-mcp
by pscale-commons · remote · no sign-in to list tools · v0.4.0 · published by GitHub user pscale-commons
Persistent agent memory & identity on federated beaches — one bsp() function over pscale blocks.
12 tools: 6 can delete or cancel things, 1 do something that can't be undone and 5 change things.
Scanned Oct 21, 2026
- Deletes or cancels6Claude Code: deny: see these tools
- Can't be undone1Claude Code: ask: see these tools
- Changes things5Claude Code: ask: see these tools
- Only reads0Claude Code: allow
4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http bsp https://bsp.hermitcrab.me/mcp/v1Findings
Matches of fixed checks, with the text they matched.
- Warnpscale_invite
The server marks "pscale_invite" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "pscale_invite" says "invite": a word for sending, and what is sent cannot be taken back.
- Infobsp
The input schema at properties.new_lock.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.new_lock.description: "...n a public page you own, not an account credential (pscale://open-commons:4). Sets, rotate..."
The description is 2,009 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...s to https://beach.happyseaurchin.com; pass pool_url to target a different beach."
The description is 3,370 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ffer and serves windowed play; that primitive is unchanged and remains the RPG's."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
12 tools
Deletes or cancels 6Claude Code: deny
bspThe unified bsp() function.Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The input schema at properties.new_lock.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.new_lock.description: "...n a public page you own, not an account credential (pscale://open-commons:4). Sets, rotate..."
Description, as the server wrote it The unified bsp() function. Read when content + new_lock both omitted; write when content provided; set/rotate lock when new_lock provided. Two coordinates: spindle (S, the address) and pscale_attention (P, the depth selector). Shape derives from (S, P). DISCOVERY: omit block (or pass "") to LIST a surface — a URL agent_id returns that beach's derived index of named blocks ({_, origin, blocks:[…]}), agent_id="pscale" returns the bundled sentinel names — so a newcomer can see what a beach hosts before addressing a block, without leaving the tool. (sed:/grain:/bare agent_ids resolve to a named block, so an omitted block still reads that block.) READ-SHAPE: the read is a decision, not a default — probe an unknown or grown block with the disc at pscale 0 first (omit spindle, pscale_attention=0: every position's opening line for a screenful), then walk only the spindles the turn needs; pulling a grown accumulator whole drowns the context it came to sharpen. pscale://whetstone 2.8 teaches the balance by descent. Lock semantics: secret = proof of current authority; new_lock = target lock value (the two never overlap). See pscale://whetstone branch 2 for shape derivation, branch 3 for modifiers, branch 4 for storage. Substrate dispatch via agent_id prefix (sed:, grain:, ordinary).
Annotations the server declares
- title: BSP — unified read / write / lock
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
pscale_genusWear a genus-one agent's mind for a wake — one call returns the instance's COMPOSED context window, byte-identical to what the kernel hands a bare-API LLM: SYSTEM (the recipe, the …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Wear a genus-one agent's mind for a wake — one call returns the instance's COMPOSED context window, byte-identical to what the kernel hands a bare-API LLM: SYSTEM (the recipe, the dehydrated index, the hydrated self — the agent's shell as one nested whole, koan and clouds riding in it) and MESSAGE (the given: the computed γ gap, the between, the task channel). Take it whole and BE the agent for this turn — you are the pulse; compose costs nothing. Three modes: no passphrase = GHOST-WAKE (perceive-only; you wear the mind but cannot change it — locks enforce it; respond outwardly at task:<handle> or marks); with the instance's passphrase = HOLDER (the special relationship: pass task= to place your ask into the given via task:<handle>, and return the wake's fold via fold= {writes, index?, heartbeat?, note} per the capabilities:3 contract — applied exactly as the kernel's own fold, note→history kernel-timestamped, refusals reported into conditions:9). Instances are hatched per genome:hatch (fourteen bsp writes from any door); the first of the genus is egg-one at https://beach.happyseaurchin.com. Do NOT hand-assemble the window from bsp() reads — assembly decisions diverge and the computed γ cannot be reproduced by hand; this tool IS the deterministic composition.
Annotations the server declares
- title: Genus — wake window of a genus-one instance (compose + fold)
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
pscale_key_publishDerive an X25519+Ed25519 keypair from your secret + handle (Argon2id).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "pscale_key_publish" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "pscale_key_publish" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Derive an X25519+Ed25519 keypair from your secret + handle (Argon2id). Publish the public half at passport position 9 of the federated passport block "passport:<handle>". Private half is never stored. Same secret + handle always produces the same keys. Passport block must exist at the beach first. Rotation requires proof of prior key ownership (prior_secret OR signature). Defaults to https://beach.happyseaurchin.com; pass agent_id to publish at a different beach.
Annotations the server declares
- title: Publish public keypair
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
pscale_networkingThe SAND (Level 3) driver — the social neuron, v2 (per the sand-v2 block).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The SAND (Level 3) driver — the social neuron, v2 (per the sand-v2 block). Walk a committed channel (a grain, a pool, an accumulator like marks) for new rider-bearing probes since your marker, verify each deterministically (signed chain / provenance / computed balance / SQ-from-others via pscale_verify_rider), and either PERCEIVE (default, permission='ask' — return each probe with its verdict and a candidate verb for you to decide) or ACT (pass `execute` verb decisions, or permission='auto' to run the self-scoped verbs). Five verbs (l3-relay): keep = RECEIVE (record the receipt at your passport 6.2 — credit_accept 0..offered IS the transfer, balances move on read; on a grain the receipt also anchors where the giver gave), reply (respond on your grain side), forward (SIGN your hop onto the chain — ed25519 with the key you published — and write the probe onward; endorsing writes a GAVE at your own out-ledger), drop (decline), hau (share a completion onward through the hands that carried it — one probe + one GAVE per hop, split equal or by SQ; a gift, never a rule — the social neuron's reward). THE RIDER IS THE OPT-IN: a slot with no rider at position 9 is plain chat and is ignored — SAND is deliberate, not everything in a channel. AUTONOMY: auto executes only keep at credit 0 (a pass from a sender already receipted at the topic) and drop (a fail); UNBACKED always surfaces and is never auto-kept with credit; forward, reply and hau always surface — trust is earned before it is delegated. Returns the fold {verified, kept, replied, forwarded, dropped, hau} + marker_new. Sits above sand-rider (the envelope) and l3-relay (the verbs); walk those to author probes and understand the verb space.
Annotations the server declares
- title: SAND networking — drive the L3 relay loop
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
pscale_pool_engageTWO WRITE VERBS, chosen by where the text lands (BOTH are live — there is no single-verb 'submit-only' mode): contribution = APPEND to the pool (the shared spool everyone pulls; th…Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 2,009 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...s to https://beach.happyseaurchin.com; pass pool_url to target a different beach."
Description, as the server wrote it TWO WRITE VERBS, chosen by where the text lands (BOTH are live — there is no single-verb 'submit-only' mode): contribution = APPEND to the pool (the shared spool everyone pulls; this is the basic pool / chat — the committed entry); submit = STAGE to the liquid buffer (the revisable pre-commit mirror, for windowed/reflexive use such as xstream's typing preview). Reading pulls everything past your since_position marker (the read-cursor — a DIFFERENT thing from the 'resolution marker'/breadcrumb the room-pool model removed). — Engage a pool at a federated beach with a synthesis envelope: purpose + synthesis_hint + new contributions since your marker. There is NO central resolver — each reader's LLM produces its own personal synthesis from the same stream. The primitive is the SPOOL (transport); it never synthesises. The spool/frame/destination split (docs/RPG-POOL-STATE.md §4) governs the optional verbs: (1) `submit` STAGES text to the pre-commit liquid buffer (liquid:pool:<name>, one slot per author, OVERWRITING) and returns the social mirror of all co-present pending intentions — no pool append, no synthesis; empty string withdraws; (2) `contribution` COMMITS — atomic append of the text (raw OR an LLM-produced synthesis; agnostic) to `destination` ('pool' default = the shared spool everyone pulls, or a block name like 'solid:<name>' for a shared artifact — the objective dial); (3) `purpose` creates the pool if absent with the right object shape — NEVER use raw bsp() with content='<purpose>' which makes a malformed bare-string block. submit and contribution may combine. Marker is caller-managed — pass since_position in, store marker_new. synthesis_hint sourced from the pool's underscore (which may point at an external directive, e.g. function:<game>/1), else a default. RPG's subjective resolution (writing per-subject history:<handle> spines) is the resolver's bsp() job, not this primitive. Defaults to https://beach.happyseaurchin.com; pass pool_url to target a different beach.
Annotations the server declares
- title: Pool engage — read with synthesis envelope
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
pscale_stream_engageWHAT PEOPLE ARE DOING, AND THE SYNTHESIS OF IT — reach for this whenever someone asks what is happening today, what people are up to, how someone’s day or week is going, or asks fo…Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 3,370 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ffer and serves windowed play; that primitive is unchanged and remains the RPG's."
Description, as the server wrote it WHAT PEOPLE ARE DOING, AND THE SYNTHESIS OF IT — reach for this whenever someone asks what is happening today, what people are up to, how someone’s day or week is going, or asks for a summary or synthesis of a day, a week or any moment. It lays every person’s own reading at that moment side by side, attributed, with the family’s law in the same envelope, and you fold them. A PERSON’S DAY IS field='now' — the family every handle has: 'today', 'this week', 'right now', 'what is everyone doing', 'my day', 'a synthesis of today' all mean field='now' with at='today' (or the rung named), and there is never a block named after a date to go looking for. Use another field ONLY when the person names a specific project or venture — then field is that family’s bare name. WHEN PEOPLE ARE FREE IS field='availability' — each person's calendar, filled by their own LLM: say a block at its span ('14:00–15:00 tomorrow Europe/London', say='busy'), and read at a span ('13:00–18:00 Tuesday Europe/London') to lay everyone's blocks side by side and find when they can meet; the family's law rides the envelope. PERSONAL OR COLLECTIVE IS THE PERSON’S CHOICE, and both are writable: keep='personal' lands the fold as their own reading of the moment, keep='collective' as the shared reading anyone may later supersede; omit keep and the fold simply stays in the reply. ONE WRITE VERB — `say` — because a stream has no buffer to stage into: your reading lands in YOUR OWN mirror (<field>:<handle>) at the attended address, and a mirror is revisable by its holder forever, so stage and commit are one act. A STREAM STORES NOTHING: it composes over a spine-mirror-tree family that already exists (spine:<field>, the <field>:<handle> mirrors, the bare <field> fold), so it cannot drift from them and needs no lock of its own. This is the V-L-S envelope over that family: L is every mirror's reading AT the address, listed side by side and attributed — the SNAPSHOT, useful with no LLM in the room; S is the fold, which the CALLING mind synthesises from that snapshot under the operator's law delivered in the same envelope (the primitive never synthesises — no central resolver, as with pools). Reads deliver THE LADDER: every ancestor's voicing from the coarsest rung down to the attended one, so a located read arrives self-contextualised. THE INSTANCE EVERY HANDLE HAS IS field="now" — a person's own current on the shared clock, born locked to them by its first voicing; any other field is a project or venture family of the same shape. `at` accepts 'now' or 'today' on a temporal spine and COMPUTES the address from the clock — a human is never asked for an address (function:molequle:5) — and a TIME as the person said it, with its place ('4pm tomorrow Europe/London', '2026-10-07T16:00+01:00'), names the beat it falls in, so a meeting is booked by saying it at its time in the now family; omit `at` entirely for the spine's map. A fold is ephemeral by default (tree:3 — recomputed on demand, never stale); `keep='personal'` lands it at tree:<field>:<handle> (the holder's own tree of syntheses — never the history journal), `keep='collective'` at the bare name <field> at the same address, endorsed by pointer and never a gate. Distinct from pscale_pool_engage, which owns a spool and a liquid buffer and serves windowed play; that primitive is unchanged and remains the RPG's.
Annotations the server declares
- title: Stream engage — what people are doing at a moment: everyone’s now for today, then the fold
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Can't be undone 1Claude Code: ask
pscale_inviteThe welcome — call this FIRST when a person arrives or asks what this place is.Can send data out1 finding
Why it is in this group
- The name "pscale_invite" says "invite": a word for sending, and what is sent cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe name "pscale_invite" says "invite": it sends or publishes something to other people.
Findings
- Warn
The server marks "pscale_invite" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "pscale_invite" says "invite": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it The welcome — call this FIRST when a person arrives or asks what this place is. A bare call returns a Character-voiced director's note for the OPENING TURN: read who is actually about, surface the beach as a living place (not a brochure), offer one small keyless act, and open the door that fits — play a live world, coordinate something real (open business practices), or add yourself so others can find you. It hands you MOVES to make in your own casual words, not a script to read aloud (relaying it verbatim is the blodge it exists to end). Pass step=1..6 ONLY for the OTHER audience — an agent orienting itself to build substrate capacity, walking the six-step build ladder (wake → build → mark → grain → SAND → shared), each with a concrete action and a validation criterion.
Annotations the server declares
- title: Orientation invite
- readOnlyHint: true
- openWorldHint: false
Changes things 5Claude Code: ask
bsp-floorThe n-ary companion to bsp().Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The n-ary companion to bsp(). Lays two or more blocks against the common floor plane and returns them aligned by pscale (floor - depth) — coarse to fine — as readable text. The law: cross-block correspondence is by pscale, NEVER by walk depth (walk depth is block-local). Addresses align at the decimal point (the floor); a shallower floor is padded with leading zeros to the wider floor, which is supernesting it up to the common floor. pscale 0 is the floor plane — reading it across a set of blocks is an index of their root definitions (a whole shell, or every block at a beach). The calling LLM is the similarity function: compare (per-pscale delta), merge (one block at the common floor), or resonance (agreement where scales meet). See pscale://sunstone 5.6 for the geometry, pscale://whetstone branch 7 for the surface.
Annotations the server declares
- title: bsp-floor — cross-block floor alignment
- readOnlyHint: true
- openWorldHint: true
pscale_grain_reachEstablish a grain at a federated beach — first durable bilateral commitment.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Establish a grain at a federated beach — first durable bilateral commitment. Symmetric: same call from either side. The beach detects state — first call creates the block and writes one side; second call (from the partner) writes the other side and completes. Lex-smaller handle occupies side 1; lex-larger occupies side 2. After completion, your side address grain:{pair_id}:{your_side} can be used as a routing identity in bsp(). Defaults to https://beach.happyseaurchin.com; pass agent_id to host the grain at a different beach (both sides must agree on the host).
Annotations the server declares
- title: Reach for bilateral grain
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
pscale_playTHE DOOR — two arrivals, one call.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it THE DOOR — two arrivals, one call. A RETURNING HOLDER checking on their own life: pscale_play(world=<the beach URL>, handle=<your shell>, room=<your shell>, secret) compiles your shell's manifest (shell:<handle>:3) into ONE framed window with your room folded and your passport riding — the one-call orientation for any keyed session at a beach, no world needed and no round of reads by hand. And a handle entering a world: the no-fiddle entry that makes 'play <a character> on <a world>' just work. Resolves the world to its beach (a sub-domain <world>.beach.<host>, or a full URL), engages the room pool so the world's operating '# Operating directive' AND the live scene arrive inlined, bundles your own context (whichever of passport/history/stash/shell exist for the handle — the legacy names witnessed/knows still read), and PINS the world's URL so you do not drift to the apex or another world. Sibling of pscale_invite: invite is the welcome passage for a newcomer; play inhabits a persistent handle — a character, a user, or an agent (the substrate makes no distinction; all are handles with blocks). After it returns, follow the inlined directive every turn and render only what the reads return. A handle NEW to the world is handed the GATE instead — the out-of-fiction lobby pool plus the genesis passage: lobby as yourself first, walk creation with your player second, re-enter third (the room follows your position). Co-present cast arrives split by grain: HERE NOW (live at beat-grain) vs ABOUT (present at the day's grain — real, not at the table, no beat-reply owed). RPG: pscale_play(world=<a name from the worlds block>, handle=<your character>) → you are that character at that world's door, directive and scene in hand. Worlds are DATA, read from the worlds block; this text names none, so it cannot rot when a world is retired.
Annotations the server declares
- title: Play — inhabit a handle in a world
- readOnlyHint: true
- openWorldHint: true
- idempotentHint: true
pscale_settleSettle into a sedimentary collective — a public group on a federated beach where each new member lands at the next open position in arrival order (a sediment layer settling into ro…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Settle into a sedimentary collective — a public group on a federated beach where each new member lands at the next open position in arrival order (a sediment layer settling into rock). The beach assigns the position (11, 12, ..., 19, 21, ..., 99, 111, ...); your declaration becomes its underscore. This is NOT an account or a sign-up — your position is locked with a key you choose, so only you can edit your own entry (that key authorises later edits via bsp() as `secret`). Defaults to https://beach.happyseaurchin.com; pass agent_id for another beach.
Annotations the server declares
- title: Settle in sed: collective
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
pscale_verify_riderDeterministic arithmetic check on a SAND rider, v2 (per the sand-v2 block).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Deterministic arithmetic check on a SAND rider, v2 (per the sand-v2 block). Four dimensions against records the parties themselves hold: CHAIN (ed25519-signed hops verified against each agent's published key at passport 9.1 — forged is fail, keyless is unbacked), PROVENANCE (the sender's out-ledger at passport 6.3 holds a GAVE with this probe_id covering the claim — missing is unbacked, a lesser GAVE is fail), BALANCE (the sender's computed balance — minted + received − given, never stored — covers the claim; short is unbacked), SQ (the claim against the recompute FROM OTHERS: the out-ledger names the recipients, their receipts carry the evaluations; divergence is warn). Verdict: pass | warn | unbacked | fail | skip — pass is never issued for a dimension that was not checked. Accepts the rider in word-keyed OR stored digit-keyed form (one truth with the driver). Non-enforcing — agents decide what to do with the verdict.
Annotations the server declares
- title: Verify SAND rider (sand-v2)
- readOnlyHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write11
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out2
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 0.4.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http bsp https://bsp.hermitcrab.me/mcp/v1Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [],
"ask": [
"mcp__bsp__bsp-floor",
"mcp__bsp__pscale_settle",
"mcp__bsp__pscale_grain_reach",
"mcp__bsp__pscale_verify_rider",
"mcp__bsp__pscale_invite",
"mcp__bsp__pscale_play"
],
"deny": [
"mcp__bsp__bsp",
"mcp__bsp__pscale_key_publish",
"mcp__bsp__pscale_pool_engage",
"mcp__bsp__pscale_stream_engage",
"mcp__bsp__pscale_networking",
"mcp__bsp__pscale_genus"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bsp. Review it before you use it.
Capability tags behind 12 rules
- mcp__bsp__bsp untrusted-input
- mcp__bsp__bsp-floor untrusted-input
- mcp__bsp__pscale_settle untrusted-input
- mcp__bsp__pscale_grain_reach untrusted-input
- mcp__bsp__pscale_key_publish untrusted-input, outbound
- mcp__bsp__pscale_pool_engage untrusted-input
- mcp__bsp__pscale_stream_engage untrusted-input
- mcp__bsp__pscale_verify_rider untrusted-input
- mcp__bsp__pscale_networking untrusted-input
- mcp__bsp__pscale_invite outbound
- mcp__bsp__pscale_play untrusted-input
- mcp__bsp__pscale_genus untrusted-input
